PCI-DSS is a set of technical and operational standards designed to protect cardholder data, applicable to all entities involved in payment card processing. Compliance is essential to avoid liability for breaches while also implementing best practices for security. Businesses must assess their compliance level, complete self-assessment questionnaires, and adhere to various requirements including building secure networks and maintaining information security policies.

1. PCI - What?
the basics of PCI compliance

2. What is PCI-DSS?
Technical and Operational Standards
designed to protect cardholder data.

3. Who does it apply to?
“all entities involved in payment
card processing - including
merchants, processors, acquirers,
issuers, and service providers, as
well as all other entities that store,
process, or transmit cardholder
data.”

4. Who Says?
PCI Security Standards Council

5. Wha?
1. Credit card companies write and
decide on standards.
2. A committee of ‘interested parties’
offer input.

6. So why do I care?

7. (glass half empty)
If you process electronic payments, you
probably signed a contract that makes
you liable for a breach.

8. (glass half full)
PCI Compliance means that you are
implementing best practices that protect
you and your customers.

9. So What Next?

10. Read Everything
There are several hundred pages of
materials available online.
Study them all. Learn the vocabulary.
Understand the beast.

11. Self Assessment
Determine what level of compliance your
company is required to maintain.

12. What Merchant Level?
Merchant Level defines your
requirements for compliance and this
can vary greatly from one business to
the next.

13. Self Assessment
Questionnaire
Merchants fit into 1 of 5 SAQ categories.
Figure out which one applies to you.
Download the appropriate SAQ.

14. Requirements
1. Build and Maintain a Secure Network.
2. Protect Cardholder Data.
3. Maintain a Vulnerability Management Protocol.
4. Implement Strong Access Control.
5. Regularly Monitor and Test Networks.
6. Maintain an Information Security Policy.

15. Build and Maintain a
Secure Network
1. Install and maintain a firewall configuration to
protect cardholder data.
2. Do not use vendor-supplied defaults for system
passwords and other security parameters.

16. Protect Cardholder Data
1. Protect stored cardholder data.
2. Encrypt transmission of cardholder data across
open, public networks.

17. Maintain a Vulnerability
Management Program
1. Use and regularly update anti-virus software
programs.
2. Develop and maintain secure systems and
applications.

18. Implement Strong
Access Control Measures
1. Restrict access to cardholder data by business
need to know.
2. Assign a unique ID to each person with computer
access.
3. Restrict physical access to cardholder data.

19. Regularly Monitor and
Test Networks
1. Track and monitor all access to network resources
and cardholder data.
2. Regularly test security systems and processes.

20. Maintain an Information
Security Policy
1. Maintain a policy that addresses information
security for all personnel.

21. Report
1. Evaluate your compliance for each
point in the SAQ - it’s simply yes or
no.
2. If you are not compliant with a
standard, make a plan.

22. Monitor
1. Use a QSA to evaluate your
compliance.
2. Schedule quarterly intrusion scans
with an approved scanning vendor.

23. Remember!
1. Everyone who accepts or handles
electronic payments is affected.
2. It requires strong systems and
constant monitoring.